New mikrotik chateau 5g r17 ax

RouterOS Beginner Basics
1

Hi everyone,I just signed up because I just bought this fantastic router( chateau 5g r17 ax) and I'm thrilled with it, but unfortunately I'm having a problem that I can't solve either by doing an automatic reboot every 3 hours. Specifically, the router arrived with the menu (use network apn) set to on, and this prevents the router from connecting to the internet. The real problem is that every 4 hours I find myself with the router connected to the PC but without internet. Here in Italy, but I think everywhere, the operators do a sort of reboot of the repeaters/antennas and my router doesn't try to reconnect to the operator; the only solution is to reboot. I've seen dozens of videos about these disconnections, but the routers automatically reconnect within seconds. I've tried keeping the router connected via LAN, in Wi-Fi, with different operators, but to no avail; all the firmware is up to date. I was hoping for some help with this problem, and I apologize if I posted in the wrong section and for my poor English.

2

What you report[1] could essentially be due to:

  1. improper configuration
  2. RouterOS needing an upgrade (or a downgrade)
  3. firmware of the modem needing an upgrade

Let's start with #1, follow instructions here and post your current configuration:
Forum rules - #5 by gigabyte091

[1] which doesn't sound at all "normal", in any case there should be no need to reboot, at the most disabling/re-enabling the LTE interface should do, but certainly not every 3-4 hours

3 
# 2025-09-21 23:23:47 by RouterOS 7.20rc3
# software id =xxxxxxxxxxxxxxxx
#
# model = S53UG+5HaxD2HaxD&RG650E-EU
# serial number = xxxxxxxxxxxxx
/interface bridge
add admin-mac=xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Italy .mode=ap .ssid=MikroTik-6A4211 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Italy .mode=ap .ssid=MikroTik-6A4211 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] use-network-apn=no
add apn=internet.IT name=internet.IT
add apn=web.unomobile.it comment=unomobile name=web.unomobile.it
/interface lte
set [ find default-name=lte1 ] allow-roaming=no apn-profiles=internet.IT \
    band="" network-mode=lte,5g nr-band=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
set ether2 queue=fq-codel-ethernet-default
set ether3 queue=fq-codel-ethernet-default
set ether4 queue=fq-codel-ethernet-default
set ether5 queue=fq-codel-ethernet-default
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip upnp interfaces
add interface=bridge type=internal
add interface=lte1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Rome
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard settings
set auto-upgrade=yes
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system scheduler
add interval=3h name=reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2025-09-20 start-time=13:59:09
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :if ([system leds settings get all-leds-off] = \"never\") do={\r\
    \n     /system leds settings set all-leds-off=immediate \r\
    \n   } else={\r\
    \n     /system leds settings set all-leds-off=never \r\
    \n   }\r\
    \n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
    p\" && disabled=no)] do={\r\
    \n     /interface/wifi wps-push-button \$iface;}\r\
    \n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
4

Not at all an expert in this kind of stuff, but your APN(s) seem off.
The APN for unomobile (which I believe is a MVNO woirking on Vodafone) should be web.unomobile.it or apn.unomobile.it
The APN internet.it should be that of windtre.
Which ISP SIM are you using?
Could it be that having two of them creates a conflict of some kind?

5

I added the Unomobile profile later to see if the problem was with the Wind/Tre operator, but the same anomaly occurs with Unomobile too, I have now removed it. In the APN you have the choice of activating or deactivating the "use network APN". If I activate it, I am connected to the internet but it does not load any web pages. If I deactivate it, the router works regularly, loads pages, etc., that's why I disabled it.

Immagine 2025-09-22 124005
Immagine 2025-09-22 1240053840×2160 264 KB

6 
# 2025-09-22 13:11:12 by RouterOS 7.20rc3
# software id = 
#
# model = S53UG+5HaxD2HaxD&RG650E-EU
# serial number = 
/interface bridge
add admin-xxxxxxxxxx auto-mac=no comment=defconf name=bridge
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Italy .mode=ap .ssid=MikroTik-6A4211 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
set [ find default-name=wifi2 ] channel.skip-dfs-channels=10min-cac \
    configuration.country=Italy .mode=ap .ssid=MikroTik-6A4211 disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] use-network-apn=no
add apn=internet.IT name=internet.IT
/interface lte
set [ find default-name=lte1 ] allow-roaming=no apn-profiles=internet.IT \
    band="" network-mode=lte,5g nr-band=""
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/queue type
add fq-codel-ecn=no kind=fq-codel name=fq-codel-ethernet-default
/queue interface
set ether1 queue=fq-codel-ethernet-default
set ether2 queue=fq-codel-ethernet-default
set ether3 queue=fq-codel-ethernet-default
set ether4 queue=fq-codel-ethernet-default
set ether5 queue=fq-codel-ethernet-default
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=lte1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input in-interface-list=!LAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip upnp interfaces
add interface=bridge type=internal
add interface=lte1 type=external
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Rome
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard settings
set auto-upgrade=yes
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/system scheduler
add disabled=yes interval=3h name=reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2025-09-20 start-time=13:59:09
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :if ([system leds settings get all-leds-off] = \"never\") do={\r\
    \n     /system leds settings set all-leds-off=immediate \r\
    \n   } else={\r\
    \n     /system leds settings set all-leds-off=never \r\
    \n   }\r\
    \n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
    p\" && disabled=no)] do={\r\
    \n     /interface/wifi wps-push-button \$iface;}\r\
    \n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
7

Yep, in theory use-network-apn=yes should get the apn automagically and everything should work, but in practice you very often need to set use-network-apn=no and add manually the right APN.
Still in theory, internet.IT is not the same as internet.it, but if it works, who cares.

In any case try, INSTEAD of downright rebooting the router, to disbale the LTE interface, wait a few seconds and then re-enable it.

Instead of triggering this through scheduler, I would try making use of netwatch instead.
It is also possible that the netwatch probing/pinging will keep the connection alive.

Wind (but not only Wind) is reknown to change IP every 4 hours or so (unless this has changed lately if you search for "Windtre disconnessione ogni quattro ore" you will find many hits) and this can cause issues.

8

OK, thanks. Meanwhile, I tried disabling LTE and after a few dozen seconds I reactivated it, I'm back online as if I had rebooted. So for now, this router's firmware is not able to circumvent this problem. If I wanted to restart only the LTE as I just did, how should I do it? I've never used NetWatch, I know how to make it do an automatic reboot in a schedule, but little else. Thanks again.

9

Basically you need a set of commands, like in this thread:

In a nutshell, the "down" script:

/interface lte disable lte1
:delay 3s
/interface lte enable lte1

The plain Netwatch is easy to configure from Winbox, It already has in the GUI a "up" Tab in which you paste the (optional) log command and a "down" one in which you paste the three commands for disable, wait a few seconds, enable the LTE interface (and the optional log ones).
Make sure to use, at least for the test, the "simple" type of probe.

You might want to make a few tests changing the delay, the 3 seconds in the given example seem to me a little too short for an interface reset and also increase the interval Netwatch Is running, 10 seconds seems to me too often.

These values depend of course on how fast Is the interface reacting to the commands, but also on the time windtre needs to send the new IP, from what I have read, even on devices that correctly re-connect automatically It takes a few seconds, but It Is not clear if this time Is taken by the device or by the provider.

10

Hello emiltec,

Please use the support portal Log into Atlassian - Support and send us the supout file from your device with enabled lte debug logging. The router should be able to reconnect by itself.

LTE debug logging can be enabled through CLI by issuing this command:
/system logging add topics=lte,!raw

This article explains how to make a supout.rif file:
https://wiki.mikrotik.com/wiki/Manual:Support_Output_File

11

Hello, thanks but the link/ page:https://wiki.mikrotik.com/wiki/Manual:Support_Output_File
Wiki/Manual:Support Output File is empty
There is currently no text in this page. You can search for this page title in other pages, or search the related logs, but you do not have permission to create this page.

12

I referenced the old wiki page by mistake, here is the new link:

13

I entered the command and I think everything is set up well, at least I think so, as soon as the disconnection occurs I will generate the file

Immagine 2025-09-24 131529
Immagine 2025-09-24 1315291920×1080 193 KB

Immagine 2025-09-24 131510
Immagine 2025-09-24 1315101920×1080 194 KB

14

Only for the record, the "old" wiki page still exists, but most links have a "wiki" in the path that now needs to be removed, i.e.:
https://wiki.mikrotik.com/wiki/Manual:Support_Output_File

becomes:
https://wiki.mikrotik.com/Manual:Support_Output_File

15

Hello,
I jumped to this thread right now because I am in the exactly same scenario like you @emiltec:

  • My ISP (Very Mobile = WIND) recycles all public IPs every four hours;
  • After the timer is over, I lose all Internet connectivity and I have to disable and re-enable the lte interface to establish the connection once again.

As the @emiltec I already setup the APN to “internet.it” and disable the “use-network-apn”. In the first run I had that enabled, but could not navigate elsewhere, so the decision to disable it.

I upgraded the RouterOS and modem firmware to the latest stable version yesterday, which was day 1 of my Mikrotik Chateau AX R17.
My previous very cheap LTE modem had not any issues on reconnecting with the same ISP, so I would expect the same from this Mikrotik’s flagship.
Scripting should be my last resort.

@emiltec : could you share how did you fix the issue (if any)?

Thank you very much.

Regards.

16

Briefly:

  1. setup a netwatch
  2. in the down script, disable LTE, wait a few seconds, re-start the LTE interface, example given here:
    New mikrotik chateau 5g r17 ax - #9 by jaclaz
17

Hello,
ok, it is a valid workaround, but I would expect an automatic reconnection.
Not so gentle running a script every minute to catch something which happens every 4 hours.
Furthermore, every time I disable and re-enable the LTE interface, the TX/RX metrics have gone.

I would use this as last resort.

18

Well, while you wait for the automatic reconnection to be implemented you can use the workaround.
In this sense you can consider It a temporary workaround.
Then you can open a ticket at Mikrotik support asking for the feature to be added in a next release.

19

hello, in my enviroment i’m using hap ax3 with a quectel rm520ngl m.2/usb3 adapter, with last firmware and routeros 7.21 on Mikrotik, so Chtaeau ax is quite similar.

Provider is Tim with 5g nsa dss.

Every time i do a speed test, lte interface lost connection and on log i see

lte1 mbim: >>> E #219 - conn_ext: network params, error: NO_DEVICE_SUPPORT

could you do a test, stressing lte interface and check if we have the same problem.

ookla or google speed test create same results

thank you

20

Well, you are running a different Ros versions, on different hardware, using a different ISP, having a different issue when doing a different thing.
Maybe you should start a new, different thread ...